fix(websocket): OOB read from oversized/wrapped frame length (#852)

[ithewei]

Fixes #852 — OOB read from an oversized / wrapped WebSocket frame length.

Root cause

http/websocket_parser.c (vendored) checked body availability with:

if (p + parser->require <= end)   // s_body

For a peer-declared 64-bit payload length (e.g. all 0xFF, which also has the MSB set that RFC 6455 §5.2 forbids), parser->require is ~SIZE_MAX, so p + parser->require overflows the pointer and wraps to a value ≤ end. The check passes and frame_body is emitted with length ≈ SIZE_MAX while only a few bytes are valid. WebSocketParser.cpp then trusts it:

websocket_parser_decode((char*)at, at, length, ...);  // in-place, huge length
wp->message.append(at, length);                        // OOB read

→ out-of-bounds read / crash for any peer that can send WebSocket frames.

Fix

• websocket_parser.c: compare against the real remaining bytes, parser->require <= (size_t)(end - p), which cannot overflow.
• WebSocketParser.cpp on_frame_header: stop truncating parser->length (size_t) to int; use it only as a capacity hint capped to MAX_PAYLOAD_LENGTH — never trust a peer-declared length for allocation. (Body bytes are still appended incrementally against real buffer data.)

Verified

• Crafted frame 81 7F FF FF FF FF FF FF FF FF 41 (FIN+TEXT, 64-bit len all 0xFF, 1 payload byte):
  • before: on_frame_body length=18446744073709551615
  • after: on_frame_body length=1
• Normal frames still parse: unmasked "hello", the same frame split across two execute() calls, and a 126/16-bit-length 200-byte frame — all OK.
• make libhv + ws client/server examples build clean.

Reported by the issue author (with a minimal C-core repro); this patches the vendored parser and the product-specific amplification in the C++ wrapper.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.